Revision as of 02:53, 2 April 2018

The configuration file for DNS resolvers is /etc/resolv.conf. From resolv.conf(5):

The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.

If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.

DNS in Linux

ISPs usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.

Testing

Use drill (provided by package ldns) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in /etc/resolv.conf:

$ drill www.archlinux.org

You can also specify a specific nameserver's ip address, bypassing the settings in your /etc/resolv.conf:

Alternative DNS servers

To use alternative DNS servers, edit /etc/resolv.conf and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.

Note: Changes made to /etc/resolv.conf take effect immediately.

Tip: If you require more flexibility, e.g. more than three nameservers, you can use a local DNS resolver like dnsmasq or unbound. In this case the nameserver IP address will likely be 127.0.0.1.

OpenNIC

OpenNIC provides free uncensored nameservers located in multiple countries. The full list of public servers is available at servers.opennic.org and a shortlist of nearest nameservers for optimal performance is generated on their home page.

Yandex.DNS' speed is the same in the three modes. In Basic mode, there is no traffic filtering. In Safe mode, protection from infected and fraudulent sites is provided. Family mode enables protection from dangerous sites and blocks sites with adult content.

Preserve DNS settings

dhcpcd, netctl, NetworkManager, and various other processes can overwrite /etc/resolv.conf. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.

Modify the dhcpcd config

dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting /etc/resolv.conf. To do this, add the following to the last section of /etc/dhcpcd.conf:

nohook resolv.conf

Alternatively, you can create a file called /etc/resolv.conf.head containing your DNS servers. dhcpcd will prepend this file to the beginning of /etc/resolv.conf.

Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your /etc/dhcpcd.conf, where dns-server-ip-addressses is a space separated list of DNS IP addresses.

static domain_name_servers=dns-server-ip-addresses

For example, to set it to Google's DNS servers:

static domain_name_servers=8.8.8.8 8.8.4.4

Write-protect resolv.conf

Another way to protect your /etc/resolv.conf from being modified by anything is setting the immutable (write-protection) attribute:

# chattr +i /etc/resolv.conf

Tips and tricks

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source).
You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.